Add restic backup config

.gitignore

@@ -9,6 +9,7 @@
 !hosts/cube/grafana/
 !hosts/cube/matrix/
 !hosts/cube/nextcloud/
+!hosts/cube/restic/
 
 !hosts/disk/
 

hosts/cube/restic/default.nix

@@ -0,0 +1,19 @@
+{ config, lib, ... }: with lib;
+
+systemConfiguration {
+  secrets.resticPassword.file = ./password.age;
+
+  services.restic.backups.varlib = {
+    passwordFile = config.secrets.resticPassword.path;
+    initialize   = true;
+
+    repository = "sftp:backup@disk:cube-varlib";
+
+    paths = [ "/var/lib" ];
+
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+  };
+}

hosts/cube/restic/password.age

@@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-ed25519 +rZ0Tw Pz3T7KDCT0BXpfo7/VjZ27hWG4+ka5TLFe03L57PxyQ
+rC91EQTynNYnJbR6lUVMVfjxfVbLXRu1RjZJhzxv6rg
+-> ssh-rsa jPaU3Q
+IfTQ1kmephTH0iTiJSGzkS23yq1S6tdndiaaeTCaK3Ydj8M4wVby4Tf8L6R6Y6Zh
+fZligOmsCtFwmZ5q2MLB6ekQ40Mhw58FtYcSFQMKGp8z2gLHbeJyM4BRsJS5/HD/
+W8Pynx/tLNcgeFxh2FIkaX+4nhL6rSA1CRY2dpf7d3GTZBsDTAcfH6zeqsASfpAA
+eTlB8NtkaSgV6txR1q+WRsNNGWFlAi1Z7489sKyTYQTKZSeZDH6LC2bzNmB+/4ja
+Za611rYtRVFEhNh/3vcwZ7E9Qx3wnzEnoxbQDN/PO0SjhTXWrxOpEmuQtem7KV1W
+lGoIzaBNaJ3fC611UxTx6dtLfnGMGdPApRce7ClsT8To6FEYIEe4R2B85mzf4hKq
+4z67Jbe5QDZ9XvAigqzzqguNM5wbdEkpb83NOjNdOT8YJmikoHcmnqJIoxHvRZRT
+hAZqYIQ9112hRi1p6aJWdmh+B1NKRZLLVFdNVucbJMaspr+JLwD/5apibbb5+zLs
+
+--- 7UuZuVFP5t6IqQJxTyRrHIU/YkHPAgqeNr/D+VOPQRI
+›<04>ÕM &bÂDešb¶CvQÚ2Ñ(dêÂSTFQ>„³
+å?"ªFF&^ˆùûú£ç

secrets.nix

@@ -17,6 +17,8 @@ in with keys; {
 
   "hosts/cube/nextcloud/password.age".publicKeys  = [ cube enka ];
 
+  "hosts/cube/restic/password.age".publicKeys = [ cube enka ];
+
   ### disk
   "hosts/disk/id.age".publicKeys              = [ cube enka ];
   "hosts/disk/password.floppy.age".publicKeys = [ disk enka ];